SMAUG-T is a Module-LWE/LWR-based Key Encapsulation Mechanism (KEM) scheme, one of the Round 2 candidates in the Korean Post-Quantum Cryptography (KpqC) Standardization Competition. It partly follows the design of Kyber, the NIST’s PQC standard, while utilizing the sparse secret to achieve smaller sizes with better performance. Recently, Bernstein (KpqC-bulletin 2024) claimed that SMAUG-T contains sub-procedures that are not constant-time, which makes it vulnerable to an efficient key recovery attack. Additionally, Lee et al. (EPRINT 2024) presented an improved version of May’s Meet-LWE attack (Crypto 2021) on LWE using sparse secrets of fixed weights, which lowered the security of SMAUG-T level-5 parameter than the claimed security. In this paper, we first examine potential mitigation enabling SMAUG-T to be constant-time and assess their impact on performance. The performance decreases significantly compared to the original SMAUG-T, losing one of its strengths. Moreover, to make SMAUG-T secure against the attack of Lee et al., either sizes or decryption failure probability increases by a lot. To overcome this, we introduce new designs for SMAUG-T that allow us to bypass potential non-constant time vulnerabilities and attacks exploiting the sparse secret of fixed weights. These designs not only allow efficient timing-secure implementation but also reduce the sizes and the probability of decryption failures. Notably, the public key and ciphertext sizes are reduced by 10-20% for the level-5 parameters. When comparing constant-time implementations, the new SMAUG-T outperforms Kyber, the NIST’s PQC standard, by up to$1.6\times $for encapsulation and$1.4\times $for decapsulation.
SMAUG-T is a Module-LWE/LWR-based Key Encapsulation Mechanism (KEM) scheme, one of the Round 2 candidates in the Korean Post-Quantum Cryptography (KpqC) Standardization Competition. It partly follows the design of Kyber, the NIST’s PQC standard, while utilizing the sparse secret to achieve smaller sizes with better performance. Recently, Bernstein (KpqC-bulletin 2024) claimed that SMAUG-T contains sub-procedures that are not constant-time, which makes it vulnerable to an efficient key recovery attack. Additionally, Lee et al. (EPRINT 2024) presented an improved version of May’s Meet-LWE attack (Crypto 2021) on LWE using sparse secrets of fixed weights, which lowered the security of SMAUG-T level-5 parameter than the claimed security. In this paper, we first examine potential mitigation enabling SMAUG-T to be constant-time and assess their impact on performance. The performance decreases significantly compared to the original SMAUG-T, losing one of its strengths. Moreover, to make SMAUG-T secure against the attack of Lee et al., either sizes or decryption failure probability increases by a lot. To overcome this, we introduce new designs for SMAUG-T that allow us to bypass potential non-constant time vulnerabilities and attacks exploiting the sparse secret of fixed weights. These designs not only allow efficient timing-secure implementation but also reduce the sizes and the probability of decryption failures. Notably, the public key and ciphertext sizes are reduced by 10-20% for the level-5 parameters. When comparing constant-time implementations, the new SMAUG-T outperforms Kyber, the NIST’s PQC standard, by up to1.6×for encapsulation and1.4×for decapsulation.
The NTRU lattice is a promising candidate to construct practical cryptosystems, in particular key encapsulation mechanism (KEM), resistant to quantum computing attacks. Nevertheless, there are still some inherent obstacles to NTRU-based KEM schemes in having integrated performance, taking security, bandwidth, error probability, and computational efficiency \emph{as a whole}, that is as good as and even better than their \{R,M\}LWE-based counterparts. In this work, we solve this problem by presenting a new family of NTRU-based KEM schemes, referred to as CTRU and CNTR. By bridging low-dimensional lattice codes and high-dimensional NTRU-lattice-based cryptography with careful design and analysis, to the best of our knowledge CTRU and CNTR are the first NTRU-based KEM schemes with scalable ciphertext compression via only one \emph{single} ciphertext polynomial, and are the first that could outperform \{R,M\}LWE-based KEM schemes in integrated performance. For instance, compared to Kyber that is currently the only standardized KEM by NIST, on the recommended parameter set CNTR-768 has about 12% smaller ciphertext size while encapsulating 384-bit keys compared to the fixed 256-bit key size of Kyber, security strengthened by (8,7) bits for classical and quantum security respectively, and significantly lower error probability (2−230 of CNTR-768 vs. 2−164 of Kyber-768). In comparison with the state-of-the-art AVX2 implementation of Kyber-768, CNTR-768 is faster by 1.9X in KeyGen, 2.6X in Encaps, and 1.2X in Decaps, respectively. When compared to the NIST Round 3 finalist NTRU-HRSS, our CNTR-768 has about 15% smaller ciphertext size, and the security is strengthened by (55,49) bits for classical and quantum security respectively. As for the AVX2 implementation, CNTR-768 is faster than NTRU-HRSS by 19X in KeyGen, 2.3X in Encaps, and 1.6X in Decaps, respectively.
Advances in quantum computing pose a fundamental threat to classical public-key cryptosystems, including RSA and elliptic-curve cryptography (ECC), which form the foundation for authentication and key exchange in the Transport Layer Security (TLS) protocol. In response to these emerging threats, Korea launched the KpqC (Korea Post-Quantum Cryptography) project in 2021 to design, evaluate, and standardize domestic PQC algorithms. To the best of our knowledge, this is the first systematic evaluation of the finalized Korean PQC algorithms (HAETAE, AIMer, SMAUG-T, NTRU+) within a production-grade TLS/X.509 stack, enabling direct comparison against NIST PQC and ECC baselines. To contextualize KpqC performance, we further compare against NIST-standardized PQC algorithms and classical ECC baselines. Our evaluation examines both static overhead (certificate size) and dynamic overhead (TLS 1.3 handshake latency) across computation-bound (localhost) and network-bound (LAN) scenarios, including embedded device and hybrid TLS configurations. Our results show that KpqC certificates are approximately 4.6–48.8× larger than ECC counterparts and generally exceed NIST PQC sizes. In computation-bound tests, both NIST PQC (ML-KEM) and KpqC hybrids exhibited similar handshake latency increases of approximately 8–9× relative to ECC. In network-bound tests, the difference between the two families was negligible, with relative overhead typically around 30–41%. These findings offer practical guidance for balancing security level, key size, packet size, and latency and support phased PQC migration strategies in real-world TLS deployments.
Resource-constrained devices such as wireless sensors and Internet of Things (IoT) devices have become ubiquitous in our digital ecosystem. These devices generate and handle a major part of our digital data. However, due to the impending threat of quantum computers on our existing public-key cryptographic schemes and the limited resources available on IoT devices, it is important to design lightweight post-quantum cryptographic (PQC) schemes suitable for these devices.In this work, we explored the design space of learning with error-based PQC schemes to design a lightweight key-encapsulation mechanism (KEM) suitable for resourceconstrained devices. We have done a scrupulous and extensive analysis and evaluation of different design elements, such as polynomial size, field modulus structure, reduction algorithm, and secret and error distribution of an LWE-based KEM. Our explorations led to the proposal of a lightweight PQC-KEM, Rudraksh, without compromising security. Our scheme provides security against chosen ciphertext attacks (CCA) with more than 100 bits of Core-SVP post-quantum security and belongs to the NIST-level-I security category (provide security at least as much as AES-128). We have also shown how ASCON can be used for lightweight pseudo-random number generation and hash function in the lattice-based KEMs instead of the widely used Keccak for lightweight design. Our FPGA results show that Rudraksh currently requires the least area among the PQC KEMs of similar security. Our implementation of Rudraksh provides a ~3x improvement in terms of the area requirement compared to the state-of-the-art areaoptimized implementation of Kyber, can operate at 63%-76% higher frequency with respect to high-throughput Kyber, and improves time-area-product ~2x compared to the state-of-the-art compact implementation of Kyber published in HPEC 2022.
The imminent threat posed by cryptographically relevant quantum computers necessitates a paradigm shift in public-key cryptography. Traditional schemes like RSA and Elliptic Curve Cryptography (ECC), the bedrock of modern secure communication, are vulnerable to quantum algorithms such as Shor's. This paper explores Module-LWE (Learning With Errors) cryptosystems as a compelling post-quantum replacement for RSA. We delve into the foundational mathematical properties of Module-LWE, highlighting its security rooted in the presumed intractability of hard lattice problems. A key focus is the concept of "tightly reduced hardness," which signifies that the security of a cryptographic scheme based on Module-LWE can be directly and efficiently linked to the worst-case hardness of an underlying lattice problem. This tight reduction allows for more aggressive parameter choices, leading to improved efficiency, smaller key and ciphertext sizes, and enhanced performance compared to generic LWE or other post-quantum candidates, without compromising security. We analyze the advantages of Module-LWE in terms of provable security, performance characteristics, and its suitability for key encapsulation mechanisms and digital signatures. The discussion encompasses its practical implications, implementation considerations, and its strong position within the NIST Post-Quantum Cryptography standardization effort, ultimately presenting Module-LWE as a robust, efficient, and future-proof alternative to RSA in a post-quantum world.
Classical public-key cryptography, mainly RSA, is at risk from the emergence of quantum computers. A complete shift to Post-Quantum Cryptography (PQC) faces vulnerabilities due to implementation and trust issues, despite NIST's approval of standards such as ML-KEM (Kyber). This paper presented a performance and bandwidth trade-off study of a proposed Hybrid Key Encapsulation Mechanism that fused the NIST-standardized ML-KEM-768 (FIPS 203) with the traditional RSA-3072. Two separate secret keys S1 and S2 were produced and encapsulated utilizing both classical and post-quantum public keys in our dual-layered model. In order to create a strong session key that ensures trust transition and backward compatibility with current network infrastructures, these secrets were then combined using a Hybrid Key Derivation Function (HKDF). In comparison to standalone systems, the study assessed the computational cost and communication latency brought about by this hybrid overhead. According to experimental data, the hybrid architecture offers a crucial security fail-safe against both classical flaws and future quantum threats without prohibitively high performance, even though it increases ciphertext size.
The security of most widely used public-key cryptography is fundamentally based on two computationally intractable problems: the integer factorization problem and the elliptic-curve discrete logarithm problem. However, these problems can be solved easily in polynomial time with the help of large-scale quantum computers using Shor's, Proos and Zalka's algorithm. Post-quantum cryptography provides schemes based on hard problems that are hard-to-solve not only by adversaries with classical computers but also by adversaries with large-scale quantum computers. Lattice-based cryptography is a branch of post-quantum cryptography consisting of schemes based on hard lattice problems. The National Institute of Standards and Technology (NIST) recently published the first set of standard post-quantum schemes. Kyber and HQC are the standard key-encapsulation mechanism/public-key encryption schemes, whereas Dilithium, Sphincs+, and Falcon are the standard digital signature algorithms. Although NIST's selection of the first set of post-quantum cryptographic standards is one of the most significant steps toward the transition from classical public-key cryptography to post-quantum cryptography, the field of post-quantum cryptography is still in a nascent stage compared to the decade-old classical public-key cryptography, such as RSA or ECDSA. Therefore, a major focus of this thesis is to bridge the gap between the theory and practice of post-quantum cryptography by exploring various problems that arise during the real-world deployment of post-quantum cryptography. Specifically, I focus on improving the practicality of lattice-based cryptography by proposing new efficient schemes, designing lightweight post-quantum schemes suitable for resource-constrained devices, efficient implementations, analyzing practical physical attacks on implementations of the post-quantum schemes, and designing their countermeasures to thwart the attacks. The first area of research of this dissertation is the exploration of various design choices for lattice-based key-encapsulation mechanisms to make them suitable in different environments under various operational constraints such as memory, silicon area, execution time, power requirement, etc. In our first contribution, we have explored various design choices for lattice-based key-encapsulation mechanisms, focusing on improving execution time on various hardware and software platforms. Our first design, Scabbard, is a suite of three key-encapsulation mechanisms that improved the state-of-the-art post-quantum key-encapsulation mechanism designs by reducing execution time, stack memory requirements, and/or area footprint. In our second contribution, we performed another design space exploration based on hardware resources (such as block RAM, distributed RAM, look-up tables, etc.) estimation and proposed the lattice-based key-encapsulation mechanism, Rudraksh, for resource-constrained devices. We also substantiate our claim of its usefulness with real-world implementations on an FPGA. The second area of research of this dissertation is the analysis of physical attacks. This attack analysis is essential when the attacker can access a device that executes cryptographic implementations, and such scenarios occur frequently in real-world deployments. Therefore, this is a crucial problem to address before deploying post-quantum cryptographic schemes in real-world applications, and countermeasures against physical attacks need to be developed as a prevention measure. In our third contribution, we proposed side-channel attack-resistant masked implementations of lattice-based KEM, Saber KEM, one of the NIST finalist KEMs. We showed that masked Saber outperforms the state-of-the-art masked implementations of Kyber, one of the NIST standards. Our investigations show that this is largely due to power-of-two moduli. Our final contribution to this thesis is physical attack analyses on implementations of the standard key-encapsulation mechanism Kyber. We proposed a cross-attack, fault-injection attack on the masked implementation of Kyber. We showed that the exploited vulnerability was introduced due to the algorithmic change caused by masking.